1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
# -*- shell-script -*-
#
# Ferm example script
#
# Firewall configuration for a dedicated mail server.
#
# Author: Max Kellermann <max@duempel.org>
#
@def $NET_TRUSTED = 195.135.144.144/28;
table filter {
chain INPUT {
policy DROP;
# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
# allow local connections
interface lo ACCEPT;
# respond to ping
proto icmp icmp-type echo-request ACCEPT;
# remote administration from the company network
saddr $NET_TRUSTED proto tcp dport ssh ACCEPT;
# our services to the world
proto tcp dport (smtp ssmtp qmtp pop3 pop3s imap2 imap3 imaps) ACCEPT;
# some SMTP servers use ident
proto tcp dport auth REJECT;
# the rest is dropped by the above policy
}
# outgoing connections are not limited
chain OUTPUT policy ACCEPT;
# this is not a router
chain FORWARD policy DROP;
}
|
